@cloud-cli/px 3.4.0 → 3.4.2

package/README.md

@@ -1,8 +1,8 @@
-## PX
+# PX
 
-Reverse proxy to map local services to http(s) subdomains
+Reverse proxy to map local services and external http(s) domains
 
-#### Usage
+## Usage
 
 Use it with [Cloudy](https://github.com/cloud-cli/cli)
 
@@ -14,11 +14,11 @@ import proxy from '@cloud-cli/px';
 export default { proxy };
 ```
 
-#### API
+## API
 
 **Add a proxy to a local service**
 
-```
+```bash
 cy proxy.add --domain "foo.example.com" --target "http://localhost:1234"
 ```
 
@@ -26,42 +26,43 @@ All available options:
 
 - `domain`: entrypoint for reverse proxy
 - `target`: any target for requests, can be local or remote
+- `cors`: handle CORS request on proxy level. See notes below!
 - `redirect`: if request comes as http, redirect to https
 - `redirectUrl`: if provided, issues a `Location` header and terminates with status 302 instead of proxying a request
 
 **Remove a proxy**
 
-```
+```bash
 cy proxy.remove --domain "foo.example.com"
 ```
 
 **Get details of a proxy**
 
-```
+```bash
 cy proxy.get --domain "foo.example.com"
 ```
 
 **List proxies**
 
-```
+```bash
 cy proxy.list
 ```
 
 **List registered domains**
 
-```
+```bash
 cy proxy.domains
 ```
 
 **Reload all configurations**
 
-```
+```bash
 cy proxy.reload
 ```
 
 ## Certificate file resolution
 
-```
+```bash
 certificatesFolder  = '/etc/letsencrypt/live' or process.env.PX_CERTS_FOLDER
 rootDomain          = 'example.com' in 'xyz.example.com'
 cert                = certificatesFolder + '/' + rootDomain + '/' + certificateFile
@@ -70,7 +71,20 @@ key                 = certificatesFolder + '/' + rootDomain + '/' + keyFile
 
 So xyz.example.com points to:
 
-```
+```bash
 /etc/letsencrypt/live/example.com/fullchain.pem   for certificate
 /etc/letsencrypt/live/example.com/privkey.pem     for private key
 ```
+
+## Notes
+
+CORS handling on proxy level is convenient, **but a security risk**. Beware:
+
+- All origins are allowed, all common methods and headers, and credentials are enabled.
+- In case of an `OPTIONS` request, if coming via CORS (a preflight), an empty response will be send and the request ends before calling the proxied target.
+
+Every request has 2 additional headers:
+
+- x-forwarded-for: the host of the original request.
+If a proxy is from 'https://foo.example.com' to 'http://localhost:1234', the header will be 'foo.example.com'
+- x-forwarded-proto: 'http:' or 'https:', depends on the original request

package/dist/proxy.d.ts

@@ -1,5 +1,10 @@
 /// <reference types="node" />
-import { IncomingMessage, ServerResponse } from 'http';
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+import { IncomingMessage, ClientRequest, ServerResponse } from 'http';
+import { ServerOptions as HttpsServerOptions } from 'https';
+import { SecureContext } from 'tls';
 import { Resource } from '@cloud-cli/store';
 export declare class ProxyEntry extends Resource {
     id: number;
@@ -10,12 +15,8 @@ export declare class ProxyEntry extends Resource {
     cors: boolean;
     constructor(p: Partial<ProxyEntry>);
 }
-interface Certificates {
-    key: string;
-    cert: string;
-}
 export declare class ProxyServer {
-    protected certs: Record<string, Certificates>;
+    protected certs: Record<string, SecureContext>;
     protected targets: Record<string, ProxyEntry>;
     protected servers: any;
     start(): void;
@@ -23,8 +24,11 @@ export declare class ProxyServer {
     protected loadCertificates(): Promise<void>;
     protected loadTargets(): Promise<void>;
     protected serveRequest(req: IncomingMessage, res: ServerResponse, insecure?: boolean): void;
-    protected getSslOptions(): {
-        SNICallback(domain: string, cb: Function): any;
-    };
+    protected getSslOptions(): HttpsServerOptions;
+    protected findRootDomain(domain: string): SecureContext;
+    protected setHeaders(from: IncomingMessage, to: ServerResponse | ClientRequest): void;
+    protected getOrigin(req: IncomingMessage): URL;
+    protected getHost(string: string): string;
+    protected setCorsHeaders(req: IncomingMessage, res: ServerResponse): void;
+    protected handleError(error: any, res: ServerResponse): void;
 }
-export {};

package/dist/proxy.js

@@ -4,12 +4,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { createServer as createHttpServer, request as httpRequest } from 'http';
+import { createServer as createHttpServer, request as httpRequest, } from 'http';
 import { createServer as createHttpsServer, request as httpsRequest } from 'https';
 import { createSecureContext } from 'tls';
 import { Model, Primary, Property, Query, Resource } from '@cloud-cli/store';
-import { readdir, readFile, stat } from 'fs/promises';
-import { existsSync } from 'fs';
+import { readdir, readFile } from 'fs/promises';
 import { join } from 'path';
 const certificatesFolder = process.env.PX_CERTS_FOLDER || '/etc/letsencrypt/live';
 const certificateFile = 'fullchain.pem';
@@ -62,18 +61,17 @@ export class ProxyServer {
     }
     async loadCertificates() {
         const certs = (this.certs = {});
-        const localCerts = await readdir(certificatesFolder);
-        const folders = await Promise.all(localCerts.map(async (dir) => {
-            const status = await stat(join(certificatesFolder, dir));
-            return status.isDirectory() ? dir : '';
-        }));
-        folders.filter(Boolean).forEach(async (rootDomain) => {
-            console.log(`Loading certificate for ${rootDomain}`);
+        const localCerts = await readdir(certificatesFolder, { withFileTypes: true });
+        const folders = localCerts.filter((entry) => entry.isDirectory()).map((dir) => dir.name);
+        for (const rootDomain of folders) {
+            if (process.env.DEBUG) {
+                console.log(`Loading certificate for ${rootDomain}`);
+            }
             certs[rootDomain] = createSecureContext({
                 cert: await readFile(join(certificatesFolder, rootDomain, certificateFile), 'utf8'),
                 key: await readFile(join(certificatesFolder, rootDomain, keyFile), 'utf8'),
             });
-        });
+        }
     }
     async loadTargets() {
         const targets = await Resource.find(ProxyEntry, new Query());
@@ -81,7 +79,7 @@ export class ProxyServer {
         targets.forEach((entry) => (this.targets[entry.domain] = entry));
     }
     serveRequest(req, res, insecure = false) {
-        const origin = getOrigin(req);
+        const origin = this.getOrigin(req);
         const proxyEntry = this.targets[origin?.hostname];
         if (!origin.hostname || !proxyEntry) {
             res.writeHead(404, 'Not found');
@@ -105,23 +103,25 @@ export class ProxyServer {
         const url = new URL(req.url, target);
         const isCorsPreflight = req.method === 'OPTIONS' && proxyEntry.cors;
         if (isCorsPreflight) {
-            setCorsHeaders(req, res);
+            this.setCorsHeaders(req, res);
             res.writeHead(204, { 'Content-Length': '0' });
             res.end();
             return;
         }
         const proxyRequest = (url.protocol === 'https:' ? httpsRequest : httpRequest)(url, { method: req.method });
-        setHeaders(req, proxyRequest);
-        proxyRequest.setHeader('host', getHost(target));
+        this.setHeaders(req, proxyRequest);
+        proxyRequest.setHeader('host', this.getHost(target));
         proxyRequest.setHeader('x-forwarded-for', req.headers.host);
+        proxyRequest.setHeader('x-forwarded-proto', insecure ? 'http' : 'https');
+        proxyRequest.setHeader('forwarded', 'host=' + req.headers.host + ';proto=' + insecure ? 'http' : 'https');
         req.on('data', (chunk) => proxyRequest.write(chunk));
         req.on('end', () => proxyRequest.end());
-        proxyRequest.on('error', (error) => handleError(error, res));
+        proxyRequest.on('error', (error) => this.handleError(error, res));
         proxyRequest.on('response', (proxyRes) => {
-            setHeaders(proxyRes, res);
+            this.setHeaders(proxyRes, res);
             const isCorsSimple = req.method !== 'OPTIONS' && proxyEntry.cors && req.headers.origin;
             if (isCorsSimple) {
-                setCorsHeaders(req, res);
+                this.setCorsHeaders(req, res);
             }
             res.writeHead(proxyRes.statusCode, proxyRes.statusMessage);
             proxyRes.on('data', (chunk) => res.write(chunk));
@@ -132,59 +132,61 @@ export class ProxyServer {
         const server = this;
         return {
             SNICallback(domain, cb) {
-                // TODO sanitize string to avoid file navigation!
-                const rootDomain = findRootDomain(domain);
-                if (rootDomain in server.certs) {
-                    return cb(null, server.certs[rootDomain]);
+                const rootDomain = server.findRootDomain(domain);
+                if (rootDomain) {
+                    return cb(null, rootDomain);
                 }
-                throw new Error('Not found', { cause: 404 });
+                cb(new Error('Not found', { cause: 404 }), null);
             },
         };
     }
-}
-function findRootDomain(domain) {
-    let rootDomain = '';
-    const parts = domain.split('/')[0].split('.');
-    while (parts.length) {
-        rootDomain = parts.join('.');
-        if (existsSync(join(certificatesFolder, rootDomain, certificateFile))) {
-            return rootDomain;
+    findRootDomain(domain) {
+        const parts = domain.split('/')[0].split('.');
+        const certs = this.certs;
+        while (parts.length) {
+            const rootDomain = parts.join('.');
+            if (certs[rootDomain]) {
+                return certs[rootDomain];
+            }
+            parts.shift();
         }
-        parts.shift();
+        return null;
     }
-    return '';
-}
-function setHeaders(from, to) {
-    const headers = Object.entries(from.headers);
-    for (const header of headers) {
-        to.setHeader(header[0], header[1]);
+    setHeaders(from, to) {
+        const headers = Object.entries(from.headers);
+        for (const header of headers) {
+            to.setHeader(header[0], header[1]);
+        }
     }
-}
-function handleError(error, res) {
-    console.log(error);
-    if (error.code === 'ECONNREFUSED') {
-        res.writeHead(502);
-        res.end();
-        return;
+    getOrigin(req) {
+        const host = req.headers['x-forwarded-for'] || req.headers.host || '';
+        return (host && new URL('http://' + host)) || null;
     }
-    if (!res.headersSent) {
-        res.writeHead(500);
-        res.end();
+    getHost(string) {
+        const url = new URL(string);
+        return url.hostname + (url.port ? ':' + url.port : '');
+    }
+    setCorsHeaders(req, res) {
+        const headers = req.headers;
+        const corsOrigin = new URL(req.headers.origin).origin;
+        const allowedMethod = headers['access-control-request-method'] || 'GET,HEAD,PUT,PATCH,POST,DELETE';
+        const allowedHeaders = headers['access-control-request-headers'] || '*';
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Origin', corsOrigin);
+        res.setHeader('Access-Control-Allow-Headers', allowedHeaders);
+        res.setHeader('Access-Control-Allow-Methods', allowedMethod);
+        res.setHeader('Access-Control-Allow-Credentials', 'true');
+    }
+    handleError(error, res) {
+        console.error(error);
+        if (error.code === 'ECONNREFUSED') {
+            res.writeHead(502);
+            res.end();
+            return;
+        }
+        if (!res.headersSent) {
+            res.writeHead(500);
+            res.end();
+        }
     }
-}
-function getOrigin(req) {
-    const host = req.headers['x-forwarded-host'] || req.headers.host || '';
-    return (host && new URL('http://' + host)) || null;
-}
-function getHost(string) {
-    const url = new URL(string);
-    return url.hostname + (url.port ? ':' + url.port : '');
-}
-function setCorsHeaders(req, res) {
-    const corsOrigin = new URL(req.headers.origin).origin;
-    res.setHeader('Vary', 'Origin');
-    res.setHeader('Access-Control-Allow-Origin', corsOrigin);
-    res.setHeader('Access-Control-Allow-Headers', '*');
-    res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,PUT,PATCH,POST,DELETE');
-    res.setHeader('Access-Control-Allow-Credentials', 'true');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloud-cli/px",
-  "version": "3.4.0",
+  "version": "3.4.2",
   "description": "Reverse Proxy",
   "main": "dist/index.js",
   "type": "module",